The legal and ethical aspects of software reverse engineering discussed in this paper are in the context of security research. Reverse engineering is now essential to vulnerability assessment and system interoperability, but it exists in a large gray area of the law. We have thoroughly examined the legal frameworks of various jurisdictions and discovered that more than 70 per cent of security professionals are not certain about the legal boundaries of work (Dasgupta et al., 2024). Comparative analysis shows that the EU offers clear Article 6 exception to interoperability with five conditions to the situation, whereas the DMCA Section 1201(f) in the U.S. is more restrictive in its protection, which does not include security research. We single out eight significant legal grey areas in terms of conflicts on jurisdiction, safe harbor, and disclosure. This paper will consolidate the existing law, test case law of the recent cases (2023-2025) and examine industry practice in order to record the chilling effects and the specific legal risks posed by these frameworks. As our discussion reveals, the current laws tend to be out of sync with the advancement in technology and this may make doing genuine security a hindrance. We make timely suggestions to researchers, organizations, and policymakers in order to promote a balance in protection of intellectual property and the required security research.